[anti-abuse-wg] Legal concerns, was Manual vs automated reports

 >Based on a definition of PII that does not regard IP addresses as 
personal data.

A definition that, of course, does not make sense and is not true. You 
worked on an abuse desk and you traced IP addresses all the time so 
obvious you know better.  Some people really live in some sort of 
fantasy land where common sense does not exist and even well-known facts 
are dismissed out-of-hand if it somehow affects your "religious beliefs."

People are traced all the time by IP addresses.  Whether a specifc IP 
address is PII depends upon the facts of the specific situation and you 
obviously don't have time to evaluate each specific situation if you are 
getting large number of abuse complaints. Under these circumstances you 
should probably treat all IP's as PII.